Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 301:

  HOTSPOT

  You have an Azure subscription

  You plan to deploy a new storage account

  You need to configure encryption for the account The solution must meet the following requirements:

  1. Use a customer-managed key stored in an key vault 2. Use the maximum supported bit length.

  Which type of key and which bit length should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Key: RSA

  Bit length: 4096

  Why these answers are correct:

  - Customer-managed keys (CMK) for Azure Storage use keys stored in Azure Key Vault.

  - When the requirement is “use the maximum supported bit length,” select the maximum RSA key size.

  Why the other answers are incorrect:

  - AES / 3DES: Symmetric algorithms and not the CMK pattern used for Key Vault-stored keys in this scenario.

  - 2048 / 3072: Not the maximum option when 4096 is available.

  Exam Tips:

  - For “CMK + Key Vault,” think Key Vault keys (often RSA/RSA-HSM depending on the prompt).

  - “Maximum supported bit length” --> pick the highest value offered by the question.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%)

  └── 2.2 Configure and manage storage accounts
  
    └── 2.2.4 Configure storage account encryption

• Question 302:

  You need to meet the technical requirements for the KEK.

  Which PowerShell cmdlet and key should you use?

  A. Set-AzVMDiskEncryptionExtension and Key2.
  B. Set-AzDiskEncryptionKey and Key2.
  C. Set-AzDiskDiskEncryptionKey and Key1.
  D. Set-AzVMDiskEncryptionExtension and Key1.
  D. Set-AzVMDiskEncryptionExtension and Key1.

  ---

  Explanation

  Correct Answer:

  Set-AzVMDiskEncryptionExtension and Key1.

  The planned changes require enabling Azure Disk Encryption using the specified Key Vault key. The Set-AzVMDiskEncryptionExtension cmdlet is used to enable Azure Disk Encryption on Azure VMs and can be configured to use a Key Encryption Key (KEK).

  Proof / Reasoning:

  Azure Disk Encryption on a VM is enabled via Set-AzVMDiskEncryptionExtension.

  Case study identifies Key1 as the active key to be used.

  References (APA):

  Microsoft. (n.d.). Set-AzVMDiskEncryptionExtension (Az.Compute). Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/powershell/module/az.compute/set-azvmdiskencryptionextension Microsoft. (Last updated 2025-09-24). Azure Disk Encryption for Windows virtual machines. Retrieved 2026-01-31 from https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-windows Microsoft. (Last updated 2024-08-22). Creating and configuring a key vault for Azure Disk Encryption. Retrieved 2026-01-31 from https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-key-vault

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.2 Create and configure virtual machines |__|__3.2.2 Configure Azure Disk Encryption

• Question 303:

  You have an Azure subscription that contains two virtual machines named VM1 and VM2.

  You create an Azure load balancer.

  You plan to create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2.

  Which two additional load balancer resources should you create before you can create the load balancing rule? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a frontend IP address
  B. an inbound NAT rule
  C. a virtual network
  D. a backend pool
  E. a health probe
  D. a backend pool
  E. a health probe

  ---

  a backend pool

  a health probe

  A load balancing rule distributes traffic from a frontend to targets in a backend pool, and it relies on health probes to determine which backend instances are healthy and should receive new connections.

  Therefore, before creating the HTTPS load balancing rule, you must have:

  - A backend pool that contains (or will contain) VM1 and VM2 as the rule's targets.

  - A health probe so the load balancer can detect backend health and only send traffic to healthy instances.

  An inbound NAT rule is used for direct port mapping to a specific VM instance and is not required for a load balancing rule. A virtual network is not created "as part of" the load balancer rule prerequisites (it already exists for the VMs). A frontend IP configuration is required for a rule, but it is typically created when the load balancer itself is created; the question asks for the two additional resources commonly needed before defining the rule, which are the backend pool and probe.

  Exam Tips:

  - AZ-104 load balancer questions often test the "rule triad": frontend configuration + backend pool + health probe.

  - NAT rules are for per-VM inbound connectivity (management), not for load distribution.

  Summary:

  Azure Load Balancer prerequisites for creating an HTTPS load balancing rule.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)
  └── 4.3 Configure name resolution and load balancing
    └── 4.3.2 Configure an internal or public load balancer

• Question 304:

  HOTSPOT

  You have an Azure subscription.

  You plan to create the Azure Storage account as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  The minimum number of copies of the storage account will be: 3
  
  To reduce the cost of infrequently accessed data, modify: Access tier (default)

  Why:

  The exhibit shows replication set to Locally redundant storage (LRS), which keeps three synchronous copies in one region. To reduce costs for infrequently accessed blob data, change the account’s default access tier from Hot to Cool (or set the tier per blob).

  Evidence (short excerpts):

  LRS copies your data synchronously three times within a single physical location in the primary region. (Microsoft Learn)

  You can change the default access tier for an account between Hot and Cool at any time. (Microsoft Learn)

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%)
  
  |__ 2.2 Configure and manage storage accounts
  
  |__ 2.2.1 Create and configure storage accounts
  
  |__ 2.2.2 Configure storage account encryption and replication
  
  |__ 2.3 Configure Azure Files and Azure Blob Storage
  
  |__ 2.3.3 Configure storage tiers

• Question 305:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.

  You need to create a new network interface named NIC2 for VM1.

  Solution: You create NIC2 in RG2 and Central US.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  No

  ---------------------------------------------------------------------------------------------------------------------------------

  The solution does NOT meet the goal.

  - A network interface (NIC) that you plan to attach to a VM must be created in the **same location (region)** and **same subscription** as the VM. VM1 is in **West US**, but the solution creates NIC2 in **Central US**, so NIC2 cannot be attached to VM1. (1)(2)

  - Resource group selection does not fix the issue: a resource group is a management container and does not impose a "same-region" constraint on the resources inside it. The blocker here is strictly the NIC-to-VM **region** requirement. (1) (2)

  Therefore, creating NIC2 in RG2 is fine, but creating it in Central US prevents it from being used by VM1 in West US.

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Microsoft Learn - Virtual networks and virtual machines in Azure (NIC location constraint) Link: https://learn.microsoft.com/en-us/azure/virtual-network/network-overview Date accessed: 2026-01-22 Last updated on: 2025-04-15

  (2) Microsoft Learn - Create, change, or delete a network interface (NIC must match VM location/subscription) Link: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface Date accessed: 2026-01-22 Last updated on: 2025-07-28

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - **NIC + VM must match region:** If the NIC is created in a different region than the VM, the answer is almost always **No**, regardless of resource group. (1)(2)

  - **Don't confuse "resource group location" with "resource location":** Resource group "Location" is metadata and does not force resources to be deployed in that region.

  - If the prompt says "create a new NIC for VM1," assume the NIC must be attachable to VM1-so validate attach constraints (region/subscription) first. (1)(2)

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Network interface (NIC) creation constraints

  - Region/subscription requirements for attaching NICs to VMs

  - Distinguishing resource group metadata from resource deployment location

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 4.0 Implement and manage virtual networking (15?0%) | 4.1 Configure and manage virtual networks in Azure | 4.1.1 Create and configure virtual networks and subnets

• Question 306:

  You have an Azure subscription that contains the resources in the following table.

  

  To which subnets can you apply NSG1?

  A. the subnets on VNet1 only
  B. the subnets on VNet2 only
  C. the subnets on VNet3 only
  D. the subnets on VNet2. VNet2, and VNet3
  E. the subnets on VNet2 and VNet3 only
  C. the subnets on VNet3 only

  ---

  the subnets on VNet3 only

  An NSG can be associated to a subnet (or NIC) only when the NSG and the target resource are in the "same Azure region". In the table, "NSG1 is in East US". Of the VNets listed, only "VNet3 is in East US". Therefore, NSG1 can be applied only to "subnets in VNet3" (resource group does not need to match; region does).

  Why other selections are incorrect:

  - the subnets on VNet1 only: VNet1 is West US, not East US.

  - the subnets on VNet2 only: VNet2 is West US, not East US.

  - the subnets on VNet2, VNet2, and VNet3: Includes West US VNets, which are not eligible for an East US NSG association.

  - the subnets on VNet2 and VNet3 only: Includes VNet2 (West US), which is not eligible.

  Microsoft Exam Tips:

  - For NSG-to-subnet/NIC association questions, check "region" first; resource group is usually not the limiting factor.

  - If regions differ, the association is not permitted even within the same subscription.

  Summary:

  NSG1 is in East US, so it can only be applied to subnets in the East US virtual network (VNet3).

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking 4.2 Configure secure access to virtual networks 4.2.1 Create and configure network security groups (NSGs) and application security groups

• Question 307:

  HOTSPOT

  You have peering configured as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Hosts on vNET6 can communicate with hosts on: vNET6 only To change the status of the peering connection to vNET1 to Connected, you must first: delete peering1

  Explanation:

  From the exhibit:

  - vNET6 has peering connections to vNET1 (peering1) and vNET2 (peering2).

  - Both peerings show Peering status = Disconnected.

  Connectivity impact:

  - VNet peering provides connectivity ONLY when the peering relationship is established (and exists on both sides).

  - If the peering is Disconnected, vNET6 does not have peering-based connectivity to vNET1 or vNET2.

  => Therefore, hosts on vNET6 can communicate only with vNET6.

  Fixing “Disconnected” peering:

  - A common cause is that the peering on the remote VNet was deleted/changed or is not correctly configured.

  - The practical remediation in exam scenarios is to delete the broken peering and recreate it so the link becomes Connected.

  => Therefore, first action: delete peering1.

  References (APA):

  1. Microsoft Learn. (2019, December 6). How to connect virtual networks across Azure regions with Azure Global VNet peering (Azure Friday). https://learn.microsoft.com/en-us/shows/azure-friday/how-to-connect-virtual-networks-across- azure-regions-with-azure-global-vnet-peering

  - Last updated: 2019-12-06. Date accessed: 01/27/2026.

  Microsoft Exam Tips:

  - “Disconnected” peering means you should assume the peering isn’t valid end-to-end (often missing on the remote side).

  - In many hotspot questions, “delete peering and recreate” is the intended fix because there’s no “repair” button.

  Summary:

  - VNet peering status and its impact on connectivity; typical remediation of disconnected peerings.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%) |__ 4.1 Configure and manage virtual networks |__ 4.1.4 Configure virtual network peering

• Question 308:

  You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user accounts.

  You create a new user account named AdminUser1.

  You need to assign the User administrator administrative role to AdminUser1.

  What should you do from the user account properties?

  A. From the Directory role blade, modify the directory role.
  B. From the Groups blade, invite the user account to a new group.
  C. From the Licenses blade, assign a new license.
  A. From the Directory role blade, modify the directory role.

  ---

  Explanation

  {Omit selection letters such as A, B, ETC. Please use the whole text.}

  From the Directory role blade, modify the directory role.

  ----------------------------------------------------------------------------------------------------

  You need to assign the **User administrator** directory role to AdminUser1. In Microsoft Entra ID, directory roles (admin roles) are assigned from **Entra ID > Roles & admins** (the "Directory roles blade"), or from the user's **Assigned roles** page. Therefore, using the Directory role blade to modify/assign the role is the correct approach.

  Official-source excerpt (Microsoft Learn):

  - "Browse to Entra ID > Roles & admins ... Select the desired role ... Select Add assignments ..." :contentReference[oaicite:0]{index=0}

  Why the other options are not correct:

  - From the Groups blade, invite the user account to a new group.

  - Group membership does **not** assign a Microsoft Entra *directory role* unless you specifically use a **role-assignable group** and assign the directory role to that group. The option only says "invite to a new group," which does not guarantee the User administrator role is granted.

  - From the Licenses blade, assign a new license.

  - Licensing does not assign directory roles. Roles are managed under **Roles & admins** (or user Assigned roles), not via license assignment.

  ----------------------------------------------------------------------------------------------------

  References:

  1. Assign Microsoft Entra roles (Microsoft Learn) https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/manage-roles-portal Date Modified: 2025-06-04 Date Accessed: 01/23/2026

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Know the difference between **Microsoft Entra ID directory roles** (tenant-level admin roles like *User Administrator*) vs **Azure RBAC roles** (subscription/resource roles like *Owner/Contributor*). They are assigned in different places and control different scopes.

  - Least privilege: assign only the admin role required (here, **User Administrator**), and in real environments prefer **PIM** or **role-assignable groups** to reduce standing privilege.

  Summary:

  This question tests how to assign a **Microsoft Entra ID administrative role** to a user using the correct management surface (Directory roles / Roles & admins).

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.2 Manage user and group properties

• Question 309:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.

  After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.

  To achieve this, the Per Enabled User setting must be set for the usage model.

  Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi- Factor Authentication provider data.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  No

  ----------------------------------------------------------------------------------------------------

  Creating a new MFA Provider "with a backup from existing provider data" would not be the right approach to satisfy "change the usage model" in place-particularly given that the usage model itself is not changeable after provider creation.

  Additionally, the scenario's requirement is to set the existing usage model, not to introduce a new provider as a workaround. Therefore, this solution does not meet the goal. [1]

  References:

  1. MFA Provider usage model cannot be changed after creation https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings#mfa-provider Date modified: 2025-03-04 Date accessed: 2026-01-25

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - When the question says "must be set" for an existing configuration, verify whether the platform allows modification vs requiring replacement.

  Summary:

  Why proposed MFA Provider replacement does not satisfy "set usage model" requirement.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.3 Interpret access assignments

• Question 310:

  HOTSPOT

  You have a Microsoft Entra tenant that contains the users shown in the following table.

  

  The tenant contains the groups shown in the following table.

  

  Which users and groups can be deleted? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Users you can delete: **User1, User2, User3, and User4** Groups you can delete: **Group1 and Group3 only**

  Deleting users is allowed regardless of direct/group license assignment; licenses are reclaimed when the user object is deleted.

  Groups that have **assigned licenses** typically must have those license assignments removed before deletion. In the scenario, Group2 and Group4 have an assigned license, so they are not deletable as-is. Group1 and Group3 have no assigned license, so they can be deleted.

  Group-based licensing (assigned licenses on groups). (Unknown (page retrieval returned an internal error in this run)). Microsoft Learn. https://learn.microsoft.com/en-us/entra/identity/users/groups-assign-licenses (Accessed 2026-01-30).

  Excerpt: "You can assign licenses to a group …"

  1.0 Manage Azure identities and governance (20–25%) |__1.1 Manage Microsoft Entra users and groups |__|__1.1.1 Create users and groups |__|__1.1.2 Manage user and group properties |__|__1.1.3 Manage licenses in Microsoft Entra ID